Random Password Generator

Password strength

A password's strength is how hard it is to guess. Attackers rarely type guesses by hand; they use software that can test billions of candidates per second against stolen password databases, starting with leaked passwords, dictionary words and common patterns before trying every combination.

For a truly random password, strength can be measured as entropy in bits: the length multiplied by the base-2 logarithm of the number of possible characters. Each extra bit doubles the number of guesses needed. A random 10-character password drawn from about 80 characters has roughly 63 bits of entropy. Length adds strength faster than variety does, which is why a longer password is usually the better upgrade.

How to create a secure password

Make it long. Aim for at least 12 characters for ordinary accounts and 16 or more for email, banking and password-manager master passwords. NIST's digital identity guidelines encourage services to accept long passwords and passphrases and to stop forcing arbitrary composition rules or regular changes.

Make it random. Humans are poor at randomness; we pick names, dates, keyboard walks like qwerty, and predictable substitutions such as @ for a or 0 for o, and cracking tools try all of these early. Letting a generator choose, as this page does, removes those patterns. If you need to memorize a password, a passphrase of four to six words picked at random from a large list (the diceware method) is both strong and easier to type.

Make it unique. A password reused on several sites is only as safe as the weakest of them. When one site is breached, attackers try the leaked email and password combinations on other services, a technique called credential stuffing. Every account should have its own password.

Avoid personal information. Pet names, birthdays, addresses, favorite teams and children's names are easy to find on social media and are among the first things a targeted attacker will try. Also avoid any password that has appeared in a breach; some password managers and services such as Have I Been Pwned can check this without revealing the password.

How to protect your password

Use a password manager. It generates and stores a unique random password for every site, fills them in for you, and only asks you to remember one strong master password. Reputable managers encrypt your vault on your device so the provider cannot read it. Browsers' built-in managers are a reasonable option too.

Turn on multi-factor authentication (MFA) wherever it is offered, especially for email, banking and social media. A second factor such as an authenticator app, a hardware security key or a passkey stops most account takeovers even when a password is stolen. Text-message codes are weaker than the alternatives but still far better than nothing.

Watch for phishing. Many passwords are not cracked at all but handed over on fake login pages linked from convincing emails or texts. Type the address of important sites yourself or use a bookmark, and be suspicious of any message that urgently asks you to sign in or confirm details. A password manager helps here as well, because it will not autofill on a look-alike domain.

Keep devices and software updated, avoid entering passwords on shared or public computers, and never send a password by email or chat. Do not write passwords on notes stuck to a monitor; if you must write one down, keep it somewhere physically secure. Change a password promptly if a service reports a breach or you suspect someone has seen it; otherwise there is no need to change strong, unique passwords on a schedule.

The table shows why length and randomness matter. It assumes a random password and an offline attacker testing 10 billion guesses per second, which is realistic for a fast hash on modern graphics hardware. On average an attacker finds the password in half the time shown.

Frequently asked questions